Software Security Engineer

Company: Halfaker and Associates, LLC
Location: Arlington
Posted on: February 19, 2021

Job Description:

Responsibilities

• Lead the effort in Code Security report analysis and remediation
• Support new feature and applications development to improve existing software
• Develops component architecture of the application
• Collaborate with product development and security teams to align business needs with technical solutions
• Support DevSecOps by integrating Fortify into the Jenkins DevOps pipeline
• Fix vulnerabilities in web applications utilizing Java and Spring
• Automation of processes to include Python scripting
• Provide Analysis and Remediation of Fortify Static Code Analyzer (SCA) scan findings
• Provide metrics and key performance indicators (KPI) for application security
• Provide application development security guidance to ensure applications adhered to policies, standards, and guidelines such as from OWASP and NIST 800-190 (containerization)
• Create/update program application Threat models
  Required Skills
  • Experience with Java and Python
  • Fortify management and operational experience
  • Experience in how to fix security issues like SQL injection
  • Familiarity with DevSecOps concepts
  • Ability to communicates and manage code remediation initiatives across different teams
  • Ability to provide top notch security development fixes, knowing how to fix them across the board globally and not just one singular module
  • Ability to find repeatable processes/jobs and making changes that apply to multiple initiatives
  • Ability to identify Fortify false positives, and understand/analyze coding security reports
    Qualifications
    • Bachelor's degree in computer science, engineering, math, or equivalent (4 years of additional relevant experience may be substituted for education)
    • Experience with Agile and Scrum lifecycle management
    • Familiarity with NIST Standards and ability to apply top notch security development fixes across multiple initiatives
    • Familiarity with the Risk Management Framework (RMF)
    • Experience with Cloud management/migration using Amazon Web Services (AWS), Liferay, Risk Vision, SQL injection, Jenkins
    • Experience with Twistlock and have a background in Security

Keywords: Halfaker and Associates, LLC, Arlington , Software Security Engineer, IT / Software / Systems , Arlington, Virginia